oss-security - CIFSwitch: Linux kernel/cifs-utils local root via forged cifs.spnego upcall

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <9HfNTJZbs42VU_pG0a6KlZzHfPkU933U_AOcdeUmSFDS2WwU5oyQrKN-LXzTuFFMwnXjg34lDuWnLRCTpFL-hP1IP7NvCFzxLUDn6Xu7ETw=@pm.me>
Date: Thu, 28 May 2026 07:07:11 +0000
From: manizada <manizada@...me>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CIFSwitch: Linux kernel/cifs-utils local root via forged cifs.spnego upcall

Hi folks,

Emailing here now that the embargo agreed upon with linux-distros@ has expired.

Flagging a local root vulnerability spanning both CIFS in the kernel and 
cifs-utils in userspace (originally reported to kernel/cifs maintainers on May 16).
The kernel-side (only) fix has now been public for over a week and is queued for stable:

3da1fdf4efbc ("smb: client: reject userspace cifs.spnego descriptions")

Impact:
  Unprivileged user -> root code exec on any system where:
  - cifs-utils is installed (with the default cifs.spnego rule)
  - CIFS kernel module is loadable/compiled-in (typically the case), and
  - unprivileged user/mount namespaces are enabled.

Some default AppArmor/SELinux profiles block this.

Bug:
  An unprivileged user can call request_key("cifs.spnego", ...) with a forged
  CIFS SPNEGO description. The request-key rule starts cifs.upcall as root.
  cifs.upcall then trusts attacker-supplied pid, uid, creduid, and
  upcall_target fields as if they came from kernel CIFS.

  For upcall_target=app, affected cifs-utils versions switch into the supplied
  process's namespaces and perform NSS lookup before final privilege drop.
  A private mount namespace containing attacker-controlled /etc/nsswitch.conf
  and libnss_*.so.2 is therefore sufficient for code execution in the root
  helper.

Affected distros:
  This a non-exhaustive summary of some tested distros. The full table, including 
  the cases where stock policy blocks exploitation (but relaxing AppArmor/SELinux/etc.
  enables exploitation), is in the attachment (and in an easier-to-read format in
  the writeup linked below).

  Stock-default exploitable distros
    (cifs-utils comes preinstalled in the profile + unprivileged namespaces permitted by default
    + the AA/SELinux policies, if any, do not block the attack):

    - Linux Mint Cinnamon 21.3 and 22.3
    - CentOS Stream 9 GNOME
    - Rocky Linux 9 Workstation
    - Kali Linux headless 2021.4/2022.4/2023.4/2024.4/2025.4/2026.1
    - AlmaLinux 9.7 Workstation/Azure cloud image
    - SLES 15 SP7/SAP 15 SP7/SAP 16

  Exploitable if cifs-utils is installed, with no other default config changes:
    - Ubuntu 18.04/20.04/22.04 Desktop/Server
    - Pop!_OS 22.04 Intel/24.04 Generic
    - Ubuntu 24.04 Desktop minimal/full and Server
    - Debian 11/12/13 netinst standard and GNOME/KDE/standard/XFCE
    - CentOS Stream 9 Cinnamon/KDE/MATE/XFCE
    - Rocky Linux 9 KDE/Workstation-Lite
    - openSUSE Leap 15.6 GNOME/KDE
    - openSUSE Tumbleweed GNOME/KDE
    - Rocky Linux 8 GenericCloud
    - Oracle Linux 8/9 KVM
    - Amazon Linux 2023 KVM

Immediate-term mitigations (aside from backporting the kernel fix):
  - Blocking the CIFS module from loading (assuming it's not built-in)/uninstalling cifs-utils if not used
  - Deleting/overriding the default cifs.spnego request-key rule (if Kerberos cifs is not required),
    e.g., after adjusting for your keyctl path:

    cat >/etc/request-key.d/cifs.spnego.conf <<'EOF'
    create cifs.spnego * * /usr/sbin/keyctl negate %k 30 %S
    EOF

  - Disabling unprivileged user namespaces

The CVE # assignment is still pending.

Full writeup:
  https://heyitsas.im/posts/cifswitch

PoC to validate mitigations:
  https://github.com/manizada/CIFSwitch 

Thanks,
-Asim Manizada
View attachment "cifswitch-distro-impact-table.txt" of type "text/plain" (4090 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.